Extended ACL — port range matchers
- Security
- Intermediate
- 7 min
- 2 steps
- Cisco IOS-style
Define an ACL that permits TCP destination ports 80 and 443 in one entry using range 80 443. Compares to writing two separate eq 80 and eq 443 ACEs — same behaviour, half the lines.
Open this lab in your browser →
Free · no install · no account
Scenario
Extended ACLs accept these port operators: | Operator | Match | | --- | --- | | eq <p> | exactly port p | | lt <p> | less than p | | gt <p> | greater than p | | neq <p> | not equal to p | | range <a> <b> | a ≤ port ≤ b (inclusive) | range is the compact form for contiguous port runs. Common shapes: `` permit tcp any any range 80 443 ← everything 80..443 inclusive permit udp any any range 16384 32767 ← RTP voice range permit tcp any any range 22 23 ← SSH + Telnet ` Note: range a b is inclusive on both ends. range 80 443 permits 80, 443, AND every port in between (81..442). For exactly two ports use two eq` ACEs.
Topology
1 × router · Cisco IOS-style
R1— router
What you will do
Define
ip access-list extended WEB-ONLYwith one ACE:permit tcp any any range 80 443.Append a
deny ip any any log(explicit deny so logs surface drops) and bind the ACL inbound onGi0/0.
Open this lab in your browser →
More labs on this topic
- ACL: block a single hostBeginner · 10 min
- ACL: named extended — proto + src + dstIntermediate · 12 min
- Extended ACL with
object-group networkIntermediate · 10 min - ACL — time-gated entries with
time-rangeIntermediate · 12 min
This lab in other languages
Extended ACL — Port-Range-MatcherACL extendida — coincidencias por rango de puertosACL estendida — matchers de faixa de portasACL étendue — matchers par plage de portsExtended ACL — port range matchers扩展 ACL — 端口范围匹配器ACL estesa — matcher su intervalli di porte拡張 ACL — ポート範囲マッチャー확장 ACL — 포트 범위 매처Расширенный ACL — матчеры по диапазону портовGenişletilmiş ACL — port aralığı eşleştiricileriACL mở rộng — bộ so khớp dải cổng